JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.104.39.130

172.104.39.130 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 64%: ?

64%

ISP	Linode
Usage Type	Data Center/Web Hosting/Transit
ASN	AS63949
Hostname(s)	172-104-39-130.ip.linodeusercontent.com
Domain Name	linode.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.104.39.130

Whois 172.104.39.130

IP Abuse Reports for 172.104.39.130:

This IP address has been reported a total of 25 times from 19 distinct sources. 172.104.39.130 was first reported on June 15th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇰 pengpeng	2026-06-29 03:11:37 (1 week ago)	monitor: on ser162528253480 \| port: 8019 \| ttl: 242 script: github.com/sefinek/UFW-AbuseIPDB-Report ... show more monitor: on ser162528253480 \| port: 8019 \| ttl: 242 script: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇭🇰 pengpeng	2026-06-29 02:09:38 (1 week ago)	monitor: on ser162528253480 \| port: 8766 \| ttl: 244 script: github.com/sefinek/UFW-AbuseIPDB-Report ... show more monitor: on ser162528253480 \| port: 8766 \| ttl: 244 script: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇭🇰 pengpeng	2026-06-29 01:08:34 (1 week ago)	monitor: on ser162528253480 \| port: 8816 \| ttl: 242 script: github.com/sefinek/UFW-AbuseIPDB-Report ... show more monitor: on ser162528253480 \| port: 8816 \| ttl: 242 script: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 tinect	2026-06-16 05:09:49 (2 weeks ago)	This IP was detected by CrowdSec triggering tinect/http-sensitive-file-probe	Web App Attack
🇸🇬 abuseipreport.darajati	2026-06-16 05:06:40 (2 weeks ago)	172.104.39.130 - - [2026-06-16T13:06:39+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestia ... show more 172.104.39.130 - - [2026-06-16T13:06:39+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T13:06:39+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T13:06:39+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" ... show less	Web App Attack
🇸🇬 abuseipreport.darajati	2026-06-16 03:06:36 (2 weeks ago)	172.104.39.130 - - [2026-06-16T11:06:35+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestia ... show more 172.104.39.130 - - [2026-06-16T11:06:35+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T11:06:35+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T11:06:35+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T11:06:35+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" ... show less	Web App Attack
🇸🇬 abuseipreport.darajati	2026-06-16 02:06:32 (2 weeks ago)	172.104.39.130 - - [2026-06-16T10:06:30+08:00] "POST /xmlrpc.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 ( ... show more 172.104.39.130 - - [2026-06-16T10:06:30+08:00] "POST /xmlrpc.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T10:06:30+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T10:06:30+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T10:06:31+08:00] "POST /wp-login.php HTTP/1.1" 200 5756 "http://hestiaistiviani.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" 172.104.39.130 - - [2026-06-16T10:06:31+08:00] "POST /wp-l ... show less	Web App Attack
Anonymous	2026-06-16 02:05:35 (2 weeks ago)	Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=20	Hacking
🇺🇸 TPI-Abuse	2026-06-16 01:56:36 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 172.104.39.130 (172-104-39-130.ip.linodeusercon ... show more (mod_security) mod_security (id:225170) triggered by 172.104.39.130 (172-104-39-130.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 21:56:30.584111 2026] [security2:error] [pid 13114:tid 13114] [client 172.104.39.130:61646] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.soundtrax.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.soundtrax.net"] [uri "/wp-json/wp/v2/users/"] [unique_id "ajCtTs4SB8RgrJWPLy8EmQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-06-16 01:52:57 (2 weeks ago)	172.104.39.130 - - [16/Jun/2026:04:52:56 +0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 683 "-" "Mozilla/ ... show more 172.104.39.130 - - [16/Jun/2026:04:52:56 +0300] "GET /xmlrpc.php?rsd HTTP/1.1" 404 683 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" ... show less	Web App Attack
🇩🇪 Ba-Yu	2026-06-16 01:49:22 (2 weeks ago)	WP-xmlrpc exploit	Web Spam Blog Spam Hacking Exploited Host Web App Attack
🇮🇩 Burayot	2026-06-15 23:20:39 (3 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 172.104.39.130 (SG/Singapore/172-10 ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 172.104.39.130 (SG/Singapore/172-104-39-130.ip.linodeusercontent.com): 1 in the last 3600 secs show less	Web App Attack
Anonymous	2026-06-15 21:25:50 (3 weeks ago)	Multiple, malicious web requests detected	Port Scan Hacking
🇮🇩 sockominfo	2026-06-15 20:00:28 (3 weeks ago)	Reported by TangerangKota-CSIRT. Status: MALICIOUS	Hacking Web App Attack
🇩🇪 maxpower	2026-06-15 15:19:41 (3 weeks ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 172.104.39.130 (SG/Singapore/172-104-39-130.i ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 172.104.39.130 (SG/Singapore/172-104-39-130.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 172.104.39.130 - - [15/Jun/2026:17:19:33 +0200] "GET /lock360.php HTTP/1.1" 301 281 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" "-" host=www.miafit.it show less	Port Scan

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇱 176.53.159.198

🇨🇳 111.31.134.87

🇺🇸 147.185.132.121

🇫🇷 85.25.153.183

🇳🇱 45.198.224.143

🇳🇱 45.148.10.67

🇸🇬 45.43.63.68

🇷🇴 2.57.121.25

🇧🇪 198.235.24.235

🇨🇳 125.44.16.107

🇺🇸 66.132.224.84

🇺🇸 66.132.186.209

🇱🇹 45.227.254.170

🇩🇪 15.220.152.31

🇺🇸 2605:a140:2341:2521::1

🇩🇪 213.209.159.108

🇺🇸 144.172.103.227

🇩🇪 87.106.239.83

🇫🇷 85.217.140.38

🇸🇦 51.36.227.58